1. Gerrit Code Review
Web based code review and project management for Git based projects
Johannes Barop
gateprotect AG Germany

2. Agenda

3. Agenda
● Why Code Reviews?
● Why a Dedicated Tool for Reviews?
● Google’s Web Code Review Tools
● Introducing Gerrit Code Review
● Gerrit Workflow
● Typical Lifecycle of a Change
● Access Control
● Our Experience

4. Why Code Review?

5. Why Code Review?
● Detect more problems early and save hours of error finding
○ Four eyes see more than two
● Keep code quality high
○ Enforce coding standards
● Learn from mistakes without breaking stuff
○ Mentor other developers

6. Why Code Review?
● Prepare for more delegation
○ Building trust relationships
● Everyone is responsible
○ Collective code ownership
● Asynchronous and across locations
○ Alternative to pair programming

7. Why a Dedicated Tool for Reviews?

8. ● How to review changesets?
○ In e-mails?
○ In the console?
○ In the changelog?
● When to review changes?
● How to collaborate?
● How to document the review process?
● How to integrate tools into the review?
Why a Dedicated Tool for Reviews?

9. ● How to avoid breaking the continuous integration build before applying
changesets
○ … and blocking other developers :-(
● How to enforce coding standards (whitespaces, ...)
Why a Dedicated Tool for Reviews?
How to integrate tools into the review process?

10. Google’s Web Based Code Review Tools

11. ● Created by Guido van Rossum (Author of Python)
● Named after Piet Mondrian
● Based on Perforce
● Proprietary
● Tied to Google infrastructure
Google’s Code Review Tools
Mondrian

12. ● Also created by Guido van Rossum
● Named after Gerrit Rietveld
● Based on SVN
● Hosted on App Engine (https://codereview.appspot.com)
Google’s Code Review Tools
Rietveld

13. Introducing Gerrit Code Review

14. ● Created by Shawn Pearce (Author of JGit)
● Started as set of patches against Rietveld
● Named after Gerrit Rietveld
● Intentionally created for Android Open Source Project
● Based on GIT
● Version 2: Completely rewritten in Java
○ JGit, GWT
Introducing Gerrit Code Review

15. ● Users and Groups
● Project and branch security
● Git repository browsing
● Git repository replication
● Code collaboration and review
● Code validation through Jenkins Triggers
Introducing Gerrit Code Review
Main Features

16. ● Gateprotect
● https://gerrit-review.googlesource.com
● https://review.source.android.com
● https://gwt-review.googlesource.com
● https://gerrit.chromium.org
● https://git.eclipse.org/r
● https://gerrit.libreoffice.org
● https://review.openstack.org
● https://review.typo3.org
● https://gerrit.wikimedia.org
● IBM, SAP, ...
Introducing Gerrit Code Review

17. Gerrit Workflow

18. Gerrit Workflow
● Automatic creating of topic-branches on commit
● Commits are drafts until they are merged in a real branch
● Jenkins validation
● Inline discussion on style and architecture

19. Gerrit Workflow
● Commits change during the improvement process
→ Commit hashes change
● Gerrit introduces a Change-Id to uniquely identify a change across all
drafts of it
● Assigned on commit
● Commit hook for auto-generating Change-Ids
○ scp -p -P 29418 review.example.com:hooks/commit-msg .git/hooks/
Change-IDs

20. Gerrit Workflow
Fixes IE's http status code mangling from 204 to 1223
XMLHTTPRequest object in IE will return a status code of 1223 and drops some
response headers if the server returns a HTTP/204.
This patch intercepts the original response in IE6-9 and returns 204 when the
code is 1223.
Associated issue:
http://code.google.com/p/google-web-toolkit/issues/detail?id=5031
Change-Id: I97b9094ef702cd852cc4d918183b394ffc853c32
Change-IDs

21. Gerrit Workflow
Democratic voting
● +2 Ok, Approved
● +1 Ok, someone else must approve
● 0 No score, just comments
● -1 I would not submit this
● -2 Blocks submitting

22. Gerrit Workflow
Democratic voting
● +1 and -1 are just an opinion
● +2 and -2 are allowing or blocking the change
● They do not accumulate
○ Two +1 do not equate to a +2.

23. Typical Lifecycle of a Change

24. Typical Lifecycle of a Change
master1

25. Typical Lifecycle of a Change
master1
1 local master
git clone

26. Typical Lifecycle of a Change
master1
1 local master2
git clone
git commit

27. Typical Lifecycle of a Change
master1
1 local master
2 immediate branch
2
git clone
git commit
git push for/master

28. Typical Lifecycle of a Change
master1
1 local master
2 immediate branch
Build failed!
Verified: -1
2
git clone
git commit
git push for/master

29. Typical Lifecycle of a Change
master1
1 local master
2 immediate branch
Build failed!
Verified: -1
2 2
git clone
git commit git commit --amend
git push for/master

30. Typical Lifecycle of a Change
master1
1 local master
2 immediate branch2
Build failed!
Verified: -1
2 2
git clone
git commit git commit --amend
git push for/master git push for/master

31. Typical Lifecycle of a Change
master1
1 local master
2 immediate branch2
Build failed!
Verified: -1
Build OK!
Verified: +1
2 2
git clone
git commit git commit --amend
git push for/master git push for/master

32. Typical Lifecycle of a Change
master1
1 local master
2 immediate branch2
Build failed!
Verified: -1
Build OK!
Verified: +1 Review: +2
2 2
git clone
git commit git commit --amend
git push for/master git push for/master

33. Typical Lifecycle of a Change
master1
1 local master
2 immediate branch2
Build failed!
Verified: -1
Build OK!
Verified: +1 Review: +2
2
2 2
git clone
git commit git commit --amend
git push for/master git push for/master

34. Access Control

35. ● Define who can merge changes
● Define access rights to GIT operations
● Delegate project administration
● Assign code-review voting range rights
● Organize project rights hierarchically
● Define rights to reference names by regular expressions
○ refs/heads/experimental/*
○ refs/heads/sandbox/${username}/*
Access control

36. Our Experience

37. Our Experience
● Review all changes
● Reviews may take time
○ Authors have to wait for reviews
● Every developer should do reviews
● Connect continuous integration

38. Q&A

39. ● Founded 2002
● Headquarter in Hamburg
○ Branch offices in 15 Countries
● 134 Employees
○ 50 in Research and Development
● Leading European manufacturer of network security solutions and ”
Made in Germany”
gateprotect - company profile

40. Small and Medium Companies
Modern Unified Threat Management Solution
The All-in-One-Solution for customers requiring complete protection and an easy-to-use solution...
Medium and Enterprise Companies
Next Generation Firewall Solution
The Enterprise Solution from gateprotect fulfilling the highest security needs…
gateprotect - product overview

41. Security Providers, System Retailers and Companies
Command Center – Managed Security Platform
Central management and monitoring for world-wide installed firewalls…
eGUI – The unique easy-to-use user interface
The world-wide unique graphical user interface allowing the complex network security configuration to
be more clear and understandable. Because transparency leads to security
gateprotect - product overview

42. <Thank you!>
Github: https://github.com/jbarop
Johannes Barop
gateprotect AG Germany
Google+: http://bit.ly/jbarop